How to Protect the Encryption Keys to Your Kingdom
NEWS ANALYSIS: Encryption keys are wonderful things that allow your organization to conduct secure communications without a problem, at least as long as you have control of those keys.Tatu Ylönen, CEO and founder of SSH Communications Security, was clearly frustrated as we talked over lunch. “Why can’t I get through to them,” he asked, almost rhetorically. Ylönen was expressing a level of dismay common in the security industry. Getting senior management to invest in security can be a daunting task. Unfortunately for many managers, security remains a cost center in their minds and that in turn gives them reason enough to skimp. When the quarterly balance sheets come out, it's easy to improve the bottom line by cutting back on security. That’s no surprise to the IT staff, where budgets are often cut to the point that the department can no longer function effectively. The reason that managers can get away with cutting back on critical functions such as IT services and security is because the consequences are delayed. You won’t realize the costs of cutting the security budget until a major network breach sometime later results in the theft or public exposure of customer accounts, trade secrets and internal financial records. What even makes even less sense is an organization that goes to the trouble to try to keep data out of the hands of cyber-criminals by routinely encrypting data and communications, but fails to provide the adequate resources to manage the encryption keys.
Without proper management, the keys that ensure your communications remain encrypted can frequently be found where criminals can find them. Worse, when they’re not properly managed, encryption keys may be left in place for years, long after the devices they were protecting are out of service.